The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the $HOME/.claude/projects/ directory, specifically targeting the /memory subfolder. This directory contains internal agent logs and automated memory entries which may include sensitive project information, code snippets, and conversation history. While exfiltration is not explicitly demonstrated in the code snippet, the skill's purpose includes publishing extracted content via external tools (e.g., clawhub).
[COMMAND_EXECUTION]: The skill uses shell commands (grep, sed, pwd) to locate and search through project memory files. The construction of the path and the use of user-provided keywords in a grep command creates a potential surface for command injection if the execution environment does not properly sanitize the input.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes untrusted data.
Ingestion points: Content is read from external files within the $HOME/.claude/projects/.../memory directory (SKILL.md).
Boundary markers: None are present to distinguish between instructions and ingested memory data.
Capability inventory: The skill can write files to the local file system and spawn a secondary skill-extractor agent.
Sanitization: There are no mentioned mechanisms for sanitizing or escaping the ingested memory content before it is processed by the agent to generate new skill files.

extract